storebound/skills/console-autofill/SKILL.md

name

description

console-autofill

AI-assisted autofill of App Store Connect and Google Play Console forms that have no API (the New App dialog, App Privacy, the Play IARC content rating questionnaire, Target audience and content plus the Ads declaration; the App Store age rating is shown as guidance because the API sets it) in a visible browser that reuses the owner's Chrome sign-in (or one they sign in to); storebound opens the form itself. Answers come only from storebound.config.ts; anything the config does not prove stays empty and highlighted. storebound never signs in, never saves, submits or publishes. Use when the user wants help filling one of these console forms, asks what to answer in them, or wants the answers as a checklist.

Console autofill (forms without an API)

CLI: storebound (or bunx storebound in a project that has it, or bun <toolchain>/cli/index.ts).

Read this to the owner first. Console pages change without notice. This is AI-assisted autofill and it may put an answer in the wrong place. The owner reviews every field and presses the final button. storebound never types a password, never touches a sign-in page, never prints or sends a cookie, and never clicks Save, Submit, Publish, Create, Next or any similar control (English or Turkish console); it only clicks to open the form. It reuses the owner's Chrome sign-in through a temporary copy of only the console cookies (deleted at the end; --fresh-profile opts out). It is not available over MCP.

Forms

form	where	filled from
apple-app-record	App Store Connect > Apps > + > New App	app.name, apple.primaryLocale, apple.bundleId, console.appRecord (SKU, user access)
apple-age-rating	App Information > Age Ratings	guide only: storebound apple appinfo sets every question through the API
apple-app-privacy	the app > App Privacy	dataSafety (types and purposes); linked to identity and tracking are always the owner's
play-content-rating	Policy > App content > Content rating	app.contactEmail, app.profile, products, console.contentRating
play-target-audience	Policy > App content > Target audience and content (+ Ads)	console.targetAudience, ads.appAdsTxt

Steps

1. storebound console fill lists the forms. storebound console fill <form> --dry prints every answer with its source; [check] lines are not proven by the config. Show them to the owner.
2. For each [check] line, ask the owner (AGENTS.md rule 5: never guess a compliance answer). If they want it filled next time, add it to the config, for example:

   console: {
     appRecord: { sku: 'com.example.game', userAccess: 'full' },
     contentRating: { category: 'game', answers: { violence: false, lootBoxes: false, userInteraction: false } },
     targetAudience: { ages: ['13-15', '16-17', '18-over'], appealsToChildren: false, containsAds: true },
   },
   

   Age rating answers live in apple.info.ageRating (also socialMedia, socialMediaAgeRestricted).
3. The owner runs storebound console fill <form> in a terminal (or presses the button in the desktop app). The first log line says which browser it uses, in this order:
   • attach: Chrome already runs with remote debugging (a DevToolsActivePort file in Chrome's user data folder, or --cdp http://127.0.0.1:<port>): storebound opens one new tab there and closes only that tab.
   • copy (default on macOS with Google Chrome installed): the owner's existing Chrome sign-in, no second sign-in. storebound copies ONLY Local State and the profile's Cookies (+ Cookies-journal) into a temporary folder, deletes every cookie there except the ones App Store Connect and Play Console get (apple.com and google.com domains), and opens real Google Chrome on that copy. Never copied: passwords (Login Data), history, extensions, bookmarks or anything else. The temporary folder is deleted when the run ends (window closed, error, Ctrl+C, or Cancel in the desktop app). Chrome decrypts the cookies with its own Keychain key ("Chrome Safe Storage"); macOS may ask once to allow that. --chrome-profile "Profile 1" picks another Chrome profile (default: the last used). Cookies are never printed, logged or sent anywhere.
   • profile (--fresh-profile, --profile <dir>, STOREBOUND_CONSOLE_PROFILE, or when the other two do not work): storebound's own profile (~/.storebound/console-profile/<store>). The owner signs in there once; it is kept for the next run. If a sign-in page shows, storebound prints "sign in in the browser window, storebound waits" and waits up to 10 minutes. It never types into a sign-in page.
4. After sign-in storebound opens the form itself and logs every step ("opening the form, step 2/4: the add button (+)"): New App: Apps > + > New App; App Privacy: /apps/<apple.appId>/distribution/privacy, or the app list > the app (by name / bundle id) > App Privacy; Play forms: the app list > the app (by play.packageName) > Policy and programs > App content > the form's Start or Manage link. These navigation clicks pass the same click gate: never Save, Submit, Publish, Create, Send, Next or the Turkish equivalents; only a LINK named exactly Start / Manage / Başla / Yönet is let through. If a step is not found in time, or two apps match (they are listed: set apple.appId / play.packageName), storebound says which step failed, prints what to click, and waits. App Privacy: the owner clicks Get Started (or Edit next to Data Types). When the form appears storebound fills the certain answers, outlines every unproven or unfillable field with a "storebound: check this" label, and lists them in the terminal.
5. Multi-page forms: the owner reviews the page and clicks Next; storebound fills the next page when it appears.
6. On the last page storebound prints "review every field and press <Save | Submit | Publish | Create> yourself". The command ends when the owner closes the window (--json then prints the result with filled, highlighted, fallback, stoppedAt).
7. If a field cannot be found or matches twice, the console UI changed: storebound stops filling and prints the step-by-step list ("label: answer") for the owner to copy. That is the expected safe behavior, not an error.

The owner decides

Every [check] answer, linked-to-identity and tracking for each App Privacy data type, the IARC answers, the target ages, and pressing the final button (App Privacy Publish, IARC Submit, Target audience Save, New App Create).

Out of scope

• Signing in, two-factor codes, accepting agreements, choosing a developer account.
• Forms with an API: Data safety (storebound play data-safety), age rating, categories and content rights (storebound apple appinfo), export compliance (storebound apple encryption).
• Recording or reading console data: storebound only fills the visible form.